Wireshark-users: Re: [Wireshark-users] only one instance of broadcast packets
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: "Martin Visser" <martinvisser99@xxxxxxxxx>
Date: Sun, 16 Nov 2008 08:21:12 +1100
this is the normal way switches do port mirroring. the 22 outgoing
packets are a copy of the incoming. it  will only send 1 copy to the
monitoring port.

On 11/15/08, Mihovil Pupovac <mihovil.pupovac@xxxxxxxxx> wrote:
> Hi,
> I have a DLINK switch which has all 22 Rx and Tx ports mirrored to one port
> on which i connected wireshark. Switch receives an Ethernet brodcast ARP
> request which is then forwarded to all 22 switch ports. Why does wireshark
> show only one instance of that packet instead of 22 instances? Is there a
> mechanisam which prevents wireshark to show the same packet more than once?
> How do i override that mechanisam?
>
> Best regards,
> Mihovil
>


-- 
Regards, Martin

MartinVisser99@xxxxxxxxx